Founder @ThemisLabs | Security Audits for Smart Contracts and AI Agents
Earth
Joined January 2011
- Tweets899
- Following638
- Followers372
- Likes768
We found and responsibly reported several security issues in widely used open-source AI platforms, including projects with 100K+ GitHub stars.
SSRF, Execution-control bypass, Agent tool abuse reaching sensitive data and OS-level capabilities.
Not just prompt injection. The real risk is what untrusted input can reach.
Write up here: themislabs.xyz/research
Great initiative from Superteam Vietnam for builders heading to Colosseum.
ROAD TO COLOSSEUM WORKSHOP LINEUP IS HERE. 🗓
From Solana infra and startup storytelling to pitching, office hours, and Demo Day, everything you need to learn, build, and sharpen your product before Colosseum.
Online & offline, with builders and experts from @solana, @SolanaFndn, @solscanofficial, @hashgraph, and more.
📅 Sep 17 – Oct 4
Check out the orkshops here: luma.com/superteam-vietnam
Join Road to Colosseum here: docs.google.com/forms/d/e/1F…
Build. Ship. Show your #PROOFofBUILD.
Looking forward to seeing what Vietnamese builders ship!
VIETNAM, YOUR ROAD TO COLOSSEUM STARTS HERE. 🇻🇳
Road to Colosseum registration is now OPEN!
$10K prize pool + infra credits + builder resources.
From Vietnam to Colosseum’s global stage.
📅 Sep 14 – Oct 12
Register now: forms.gle/MaCQbiJqtTDyuDvu8 View article
My key takeaway: Smart contracts are only one part of the attack surface.
🛡️ How AI Is Reshaping Digital Asset Security: Threats, Audits & Real-Time Defense
▶️ Watch the full panel discussion: youtu.be/TEzVBUXZgAI
At Conviction 2026, Takatoshi Shibayama – Head of APAC, @Ledger; Dr. @ducnst – Founder, @ThemisLabs; Rey Maximo – Vice President of Security, @SkyMavisHQ; and Carney Mak – Partner, FXHB Asset Management, moderated by Dr. Hung Dang – Head of Blockchain Lab, Van Lang University, explored how AI is changing both sides of the cybersecurity landscape.
From smart contract audits and threat detection to transaction monitoring and incident response, digital asset security is increasingly moving toward continuous, real-time defense.
AI agent security is not just about prompt injection.
Recent incidents show a different problem: malicious skills and compromised packages can turn the agent itself into part of the attack chain.
The model may be doing exactly what it was told.
The real question is: who or what is allowed to tell it what to do?
If an agent has real credentials and real access, we need to think beyond prompts.
We built Agent Intelligence to answer a simple question:
Was this agent action actually authorized by what caused it?
It tracks provenance across an agent's trajectory and evaluates whether sensitive actions are justified by the source and authority behind them.
In our evaluation, it intervened in 88.5% of evaluable harmful AgentHazard trajectories, while keeping 95.9% legitimate-task autonomy. On AgentDojo-derived cases, authorization bypass dropped from 5.5% to 1.1%.
The example below shows why this matters: the prompt guard passed, the agent executed, but Agent Intelligence recommended BLOCK.
Now running with design partners.
themislabs.xyz/ai/agent-inte…
Prompt injection does matter. Yet, the bigger question is what happens after it works.
If an agent is manipulated, the real risk comes from what it can access and what actions it is allowed to take.
That is where the blast radius is defined.
Great discussion on how AI is reshaping digital asset security with Dr. Hung Dang, Rey Maximo, Takatoshi Shibayama, and Carney Mak.
We covered AI-enabled threats, continuous security beyond audits, key/signing risks, institutional trust, post-quantum readiness, and securing AI agents that can move assets autonomously.
A lot is changing. The core question stays the same: how do we limit the damage when one part of the system is compromised?
Most AI agent security tests ask:
Can the agent be tricked?
I think the more important question starts after that:
If it is tricked once, what can the attacker actually cause?
The diagram shows the core idea.
A prompt injection test tells us the model failed.
A security assessment should also show what the system allowed that failure to become.
themislabs.xyz/research/agen…
If you attend Conviction 2026, I am happy to connect.
Conviction 2026 is honored to welcome Dr. Duc Cuong (@ducnst) – Founder, @ThemisLabs, as a speaker at the Vietnam Digital Assets & AI Economic Forum.
Holding a PhD in Information Security from Saarland University and having previously worked as a researcher at CISPA, Dr. Cuong brings over 10 years of experience across cybersecurity, AI security, and Web3 auditing. His research has been published at leading venues including IEEE S&P and ACM CCS, and he has conducted 30+ smart contract audits across EVM and Solana.
On Conviction Day 1: Blockchain & Digital Assets, Dr. Cuong will join the panel “How AI Is Reshaping Digital Asset Security: Threats, Audits & Real-Time Defense”, discussing protocol security, smart contract risks, autonomous AI agents, adversarial resilience, and real-time defense strategies.
📍 Conviction Day 1: Blockchain & Digital Assets | August 14, 2026
📍 Thiskyhall, Ho Chi Minh City
____________________
👉 Register now for Conviction 2026 & Claim your exclusive Ivy NFT for FREE: dagora.xyz/new-releases/laun…
Conviction 2026 - Vietnam Digital Asset & AI Economy Forum
📍 Location: Ho Chi Minh City, Vietnam
📅 Date: August 14-15, 2026
🌐 Website: conviction.vn/?utm_source=x&…
Sharing the recording of a talk I gave recently at @BSidesHanoi
When we call DeFi "trustless", who can still change the system after deployment?
We looked at 166 live deployments and mapped things like upgrade keys, multisigs, governance, and other privileged paths.
The main takeaway: smart contracts may reduce trust, but human control often remains. It is just less visible.
youtube.com/watch?v=BxcO-Gib…
US Patent 12,695,729 was granted last month.
The question: can you score someone’s driving behavior without being allowed to observe it?
The answer uses multi-key homomorphic encryption.
The compute node never sees the raw data. The vehicle partially decrypts the result but cannot read its own score. The insurer finishes decryption and gets the final number.
No single party can produce the answer alone.
That is also the question I now ask of DeFi upgrade keys and AI agent permissions:
Who can act without anyone else?
patents.justia.com/patent/12…
🤖 Made with AI
Duc Cuong retweeted
Last Thursday, we sat down with @ducnst, Founder of @ThemisLabs, to talk about something most builders think about only after it's too late: Securing AI agents.
The way he framed the topic really got us thinking. When security discussions center around the model, is it aligned, can it be jailbroken? An agent also has identity, authority, tools, MCP servers, memory, and approval workflows.
Every tool connected is another opportunity to increase its capabilities and the attack surface. His advice: stop worrying whether your prompt is safe, but start wondering about the authority of your agent.
⚠️ This is for information only, not a replacement for an actual security review of your system.
Had a great discussion with @SuperteamVN on securing AI agents.
One message I kept coming back to:
AI security is not only about the model. It is about authority.
Once an AI agent can read your Gmail, merge GitHub PRs, access databases, or make payments, the security model changes.
We often talk about AI replacing human work, but we still treat AI agents like tools or libraries.
I think we should start treating AI agents like employees in our organization.
Give them only the permissions they need. Separate duties. Require approval for high-impact actions. Continuously verify that they stay within the authority you intended.
That's how we should think about AI security.
STVN Workshop #3: Securing AI Agents xitter.cf/i/broadcasts/1vJpPPvaD…
Duc Cuong retweeted
We are proud to join The ISC2 Vietnam Chapter!
As the first Corporate Partner, we are committed to support cybersecurity education and invest in the growth of our local community. We are excited for this and look forward to opportunities this collaboration will bring.
Join me to build a secure world for AI agents.
Workshop #2: Securing AI Agent
Most people think about security as bug-hunting. Our guest thinks about it as a chain of authority, who's allowed to do what, and how that permission gets passed from one system to the next without anyone checking each handoff. A user asks a question, an agent picks a tool, the tool calls an MCP server, it reads Slack, opens a GitHub PR, updates a CRM, initiates a payment, touches infrastructure. Seven hops, and somewhere in there, an action happened that nobody explicitly approved.
Our guest has done 30+ smart-contract audits across EVM and Solana, and has now brought that same discipline to securing autonomous AI agents, exactly where a lot of what's being built here right now is headed.
Host: Kay @kay_x64, STVN member
Guest: Duc Cuong Nguyen @ducnst, Founder of @ThemisLabs
📅 Date: July 30
🕖 Time: 19:30 - 20:30 (GMT+7)
📍 Venue: Online, StreamYard
Submit your questions for us on this topic: forms.gle/na7rp2bThi3eAg3q8
Themis Labs secures autonomous software. That means two things: smart contracts and AI agents.
Themis Scan monitors 200+ production DeFi protocols for control-plane risk: who holds authority, what they can do, when it changes.
Today we're introducing Themis Sentinel: adversarial security assessments for LLM applications and agentic systems. Early access is open.
AI agents have authority: tool access, credentials, write permissions, MCP servers, prompt surfaces an attacker can influence. Most teams evaluate output quality and ship.
We map what your agent is actually allowed to do, then attack it: prompt injection, tool abuse, MCP exposure, data exfiltration, broken trust boundaries between agents.
Putting agents into production sooon? Happy to connect.
themislabs.xyz/ai
Big validation for agentic security as a category. Congrats to @neo_ai_security .
@neo_ai_security controls actions at the endpoint. It does not test behavior.
An agent that gets prompt-injected into leaking data through approved tools, with approved credentials at the action layer. The compromise lives in the reasoning inside the model, and no endpoint sensor sees reasoning.
That's the layer Themis AI Scan covers: we red-team agent behavior under hostile input before it ever reaches production.
Themis AI Scan catches what the agent can be convinced to do. Both are needed for enterprise.
We're excited to lead Neo's Seed round.
AI agents now run directly on the endpoint with the same privileges as the user they serve.
Every control built on the old assumption (EDR, DLP, Zero Trust) breaks the moment it can no longer tell whether an action came from the person at the keyboard or the agent acting in their name.
@neo_ai_security is pioneering agentic software control for a world where AI agents act continuously, often outnumbering the humans they serve.
Neo's founders are as strong as they come in security. Nick Warner scaled SentinelOne through its IPO. Shlomi Salem ran threat research there for 11+ years. Eran Shirazi previously co-founded and ran engineering at EasySend.
Congrats, Nick, Shlomi, Eran, and the Neo team.
By @zanelackey and Joel de la Garza
Join me at Bside Hanoi, happy to connect with more people in this space.
